Bump oxc-parser to >=0.90.0: 0.76.0 bindings lack build provenance

Would you consider bumping the `oxc-parser` dependency to `>=0.90.0`? At `0.76.0` its platform bindings publish without build provenance, which makes anything depending on componentize-js uninstallable under an installer that enforces provenance.

Filed here at the jco maintainers' suggestion — this started as [bytecodealliance/jco#1841](https://github.com/bytecodealliance/jco/issues/1841), and the reply was that the dependency needs updating here first.

The chain is `jco@1.27.0` → `@bytecodealliance/componentize-js@^0.22.0` → `oxc-parser@^0.76.0`. All 15 `@oxc-parser/binding-*` packages at `0.76.0` are missing build provenance attestations, while `oxc-parser` and `@oxc-project/types` at the same version have them.

It looks like a gap in one range rather than the norm: `@oxc-parser/binding-darwin-arm64` has attestations at `0.13.3`, none at `0.76.0`, and has them again from `0.90.0` through the current `0.143.0`. npm registry signatures are present throughout — build provenance specifically is what is missing.

Installers that enforce provenance and treat a loss of attestation as a downgrade refuse the install outright. It is not host-specific either: the resolver walks every optional binding, so all 15 have to be excluded individually to get past it, including the 13 for platforms a given project will never run.

Bumping to `>=0.90.0` would let componentize-js and jco install cleanly under those policies with no per-package exceptions.

首先定位 ComponentizeJS 中 oxc-parser 的依赖声明，并检查其版本受到怎样的约束。使用强制执行构建来源的安装配置验证依赖更新；当 componentize-js 及其下游的 jco 安装不再需要按包设置来源例外时，即表示完成。

由索引模型根据 Issue 内容生成。